Polymarket Confirms Hack via Third-Party Vendor; Affected Users Promised Full Refunds

Crypto prediction platform Polymarket confirmed that hackers stole user funds after compromising a third-party vendor, which was used to inject malicious code into the platform's website. Spokesperson Connor Brandi told TechCrunch that the vendor breach directly resulted in theft, though the company declined to disclose the total amount stolen, the vendor's identity, or the precise attack mechanism. Blockchain security firm PeckShield independently flagged suspicious on-chain activity around the same time Polymarket made its public announcement. The attack is classified as a supply chain breach, meaning Polymarket's own smart contracts were not compromised — the vulnerability existed in the conventional web infrastructure surrounding them. The platform says it has contained the incident and is contacting affected users directly with commitments to issue full refunds.